Topic
Consistency of browser-reported environment characteristics — rendering behaviour, available APIs, hardware details — as a detection signal.
Any page calling Chrome's LanguageModel and Translator APIs can pull 2.8 GB into each isolated profile, a developer running a profile fleet found. Chrome's launch flags either expose the block to pages or stop security updates, so the team patched the engine.
Reality
A dev.to audit of browser fingerprinting in 2026 rates canvas as still working on about 80% of browsers, while the signals Chrome's Privacy Sandbox froze are mostly declarative fields that automation frameworks already set by hand.
Reality
Two Bern researchers solved a rotation CAPTCHA in 0.006 seconds using circle detection from the 1970s, then fed that answer to frontier models as a tool result and watched one of them argue with it.
Reality
A practitioner who builds an automation browser argues bot detection fires in a fixed order, starting at the TLS handshake. The Bamberg crawl he cites found 75% of blocks on headless Chromium needed only HTTP headers.
Reality
Eleven look-alike sites run a scan whose score is capped at 30 out of 100, then record which of 28 security products the victim removed. Endpoint tampering by consent, over the phone.
Reality
A developer traced his cutting-out Bluetooth headphones to two silent audio graphs on the AliExpress homepage. Tab mute could not touch them, and a Firefox engineer rates the data they feed as near worthless.
Reality
Two obfuscated Alibaba anti-bot scripts on AliExpress built silent Web Audio graphs with no media element. Tab, browser and OS mute did nothing. Closing the tab worked.
Reality
A dev.to post argues that Akamai, Cloudflare, DataDome and HUMAN grade behaviour across a whole session. If it is right, the line item to grow is session capacity, not IP volume.
Reality